Connect to Exchange online (Exchange online powershell module, Connect-Exopssession) Guide here
Run the below script editing the following: (identity, targetmailbox, search query (searchable attributes here) and target folder). -force will stop the confirmation message from coming up after every deletion, this is necessary due to the time it takes to delete from a whole domain for example.
get-mailbox -resultsize unlimited -identity *@domain.co.uk | search-mailbox -targetmailbox "USERRunningSCRIPT" -SearchQuery '(sent:today) AND (subject:Subject to base deletion on)' -TargetFolder "MailboxSearches" -DeleteContent -force
This won't work on mailboxes that have multiple entries (@centralrsaacademies.co.uk and @arrowvaleacademy.co.uk
Below is an alternative method that works with users that have mulitple mailbox entries
$emails = get-mailbox -resultsize unlimited -identity *@DOMAIN.co.uk;
foreach($email in $emails.windowsliveid){search-mailbox -identity $email -targetmailbox "USERRunningSCRIPT" -SearchQuery '(sent:today) AND (subject:AA All Staff Licenses)' -TargetFolder "MailboxSearches" -DeleteContent -force}
Below is an example of finding compromised accounts, as you can search mailboxes for items that were sent from said mailbox
$emails = Get-mailbox -resultsize unlimited -identity *@arrowvaleacademy.co.uk
foreach($email in $emails.windowsliveid){$Query = "(From:" + $email + " ) AND (body:type text here*)";
search-mailbox -identity $email -EstimateResultOnly -searchquery $query}